capability-evolver
Agent Enhancement
C rating
License: MIT declared in package.json; full license not bundled
For technical users maintaining agent logs and workflows. The reviewed package reads runtime history and contains file writes, process and command calls, session cleanup and skill-update logic; it is not a read-only prompt that automatically makes an agent smarter. The distribution version is v1.27.3 while package.json says 1.12.3; these are not interchangeable release evidence.
OpenClaw
Usage instructions
Reviewed: 2026-10-18. Method: static inspection of documentation, inventory and key code, without installation, network-function execution, authorization or sandbox tests. Package SHA-256: 8798d76e122b0221b43ecbb06772cbce4b5b14dbbc0d6438afa655966ad13341. It matches the previously served local package; a different future download needs a new review.
- Unpack into a disposable project copy and read SKILL.md, index.js, src/evolve.js and src/ops. Node.js is required. Supply sanitized logs only, excluding production paths, secrets and personal sessions.
- The documentation mentions --review, but that flag is not a guarantee that the entire program is read-only. Inspect call chains, environment-supplied commands and cleanup paths before isolated execution. This page does not recommend unattended runs.
- First request an improvement proposal and affected-file list, without publishing, updating other skills or looping. Review diffs and retain recoverable backups before actual writes.
Safety review
Reference rating C is this site's editorial assessment of this package's permission risk, not a certification score: A indicates relatively low privilege, B requires review of networking or local writes, and C involves credentials, real business writes or elevated capabilities and should be evaluated in isolation. No grade guarantees freedom from vulnerabilities. Platforms identify documented targets, not completed host-by-host execution tests.
- src/evolve.js includes execSync, writes and session-file deletion; solidify and cleanup also modify files or run commands. A repair goal does not prevent excessive permissions from damaging unrelated data.
- Logs can contain conversations, credentials and business information. Do not send full histories to external models or shared services. Publishing and upstream communication require separate review.
- README and SKILL.md do not describe automation identically. Documented constraints are not runtime isolation.
Copyright and takedown notice: AI Islands curates this page from public information. Skills, code, documents and packages remain the property of their original authors or rights holders. This listing is provided for indexing, research and installation convenience. If you believe any listing or download link infringes your rights, contact ai-islands@streamflowintel.com with proof of ownership, relevant URLs and your request. We will review and remove or adjust the content promptly. Review package permissions, dependencies and safety risks before installing.